JP7694489B2 - Control device, control system, control method, and control program - Google Patents

Description

The present invention relates to a control device, a control system, a control method, and a control program.

In various plants that use oil, petrochemical, chemical, gas, etc., control systems perform various controls such as opening and closing valves and maintaining a constant temperature. For this reason, control systems must ensure reliability according to the object they are controlling.

The functions of a control device are generally composed of hardware such as a CPU (Central Processing Unit) and memory, and software such as a controller application. A controller application or controller is a control application, and hereafter they will be collectively referred to as a "controller." In addition, applications other than the controller can also run on a control device. These will be hereafter referred to as "APPs (Applications)." Furthermore, controllers and APPs will be collectively referred to as applications.

In some cases, applications run in a virtual environment on the hardware of the control device. In such cases, multiple VMs (Virtual Machines) run on the OS (Operating System) or virtual hardware, and applications run on each VM. The VMs provide a virtual OS environment, known as a guest OS or container.

In a control device, if either the hardware or software malfunctions, operation will be impaired. Therefore, a control system has been proposed that increases reliability while reducing costs by having multiple controllers execute and output predetermined calculations, and then selecting one output value from each calculation value in a selection processing unit (Patent Document 1).

Furthermore, from a software perspective, a phenomenon known as a memory leak can occur. A memory leak is, for example, a program bug in an application that causes a memory area request to be made to the OS, but the memory is not released. Repeated memory leaks can cause the memory resources held by the OS to become depleted, leading to unstable operation of the OS and all applications running on that OS.

For example, in a control system in which applications run in a virtual environment, the guest OS or virtual machine, such as a container, and the application are restarted to resolve the unstable state caused by the memory leak. However, it is preferable to avoid unstable operation between the occurrence of a memory leak and the restart, if possible. This is because if an application continues to operate in an unstable manner, there is a possibility that the impact cannot be completely suppressed by the operation of the inter-application interference prevention processing unit. Therefore, it is possible to prevent errors from occurring by restarting the application as a preventive maintenance measure before operation becomes unstable due to a memory leak.

As a technique for dealing with such memory leaks, a technique has been proposed that restarts the software causing the memory leak and also operates multiple processes that provide the service, allowing the service to continue even when some of the processes have been restarted (Patent Document 2).

JP 2020-27434 A JP 2011-54114 A

However, depending on the state of the memory leak, there is a possibility that multiple applications will be restarted simultaneously. In such a case, the technology of selecting one output value from the respective calculation values by multiple controllers may not select an appropriate value depending on the number of applications being restarted. In response to this, it has been proposed to intentionally allocate resources to different values in order to avoid the simultaneous occurrence of operational instability due to memory leaks. However, it is difficult to accurately predict the occurrence of memory leaks, and it is difficult to perform optimal resource allocation. Therefore, it is difficult to avoid operational instability of applications and improve the reliability of the control system.

In addition, with technology that runs multiple processes that provide a service and then restarts software that causes a memory leak, it is difficult to provide a highly reliable service as long as the number of processes running after the restart is less than the set number. In addition, with this technology, process management is performed by a queue unit, but queue management is difficult in processes where real-time performance is important, such as in process control systems, and there is a risk that management in the queue unit will become cumbersome. As a result, it is difficult to avoid unstable application operation and improve the reliability of the control system.

The disclosed technology aims to provide a control device, control system, control method, and control program that avoids unstable operation of applications and improves the reliability of the control system.

In one aspect of the control device, control system, control method, and control program disclosed in the present application, the control device has the following selection processing unit and application management unit. The selection processing unit selects and outputs a calculation result to be output based on the calculation results of each of a plurality of applications that execute a specified calculation. The application management unit sets one or some of the applications as a reconstruction target, and determines whether or not the reliability of the output by the selection processing unit can be ensured by the calculation of the application other than the reconstruction target by changing the determination logic according to the reliability required for the specified calculation executed by the application , and performs reconstruction of the application to be reconstructed if the reliability can be ensured.

In one aspect, the present invention can prevent instability in the operation of applications and improve the reliability of the control system.

FIG. 2 is a schematic diagram illustrating an example of a control system. 11 is a flowchart of a reconstruction process based on a reconstruction request from a VM. 13 is a flowchart of a reconstruction process based on a decision to reconstruct by an application management unit. FIG. 13 is a diagram illustrating an example of a configuration of a control system according to a modification of the first embodiment. FIG. 2 is a hardware configuration diagram of a control device.

Below, examples of the control device, control system, control method, and control program disclosed in the present application are described in detail with reference to the drawings. Note that the present invention is not limited to these examples. In addition, the same elements are given the same reference numerals, duplicated descriptions are omitted as appropriate, and each embodiment can be appropriately combined within a range that does not cause inconsistencies.

[First embodiment]
[Overall configuration]
Fig. 1 is a schematic diagram showing an example of a control system. The control system 1 shown in Fig. 1 is connected to a sensor 20 and a drive device 30 via a network. The control system 1 is used, for example, to control an industrial process 40 of a plant. In this specification, the plant includes an industrial plant such as a chemical plant, a plant that manages and controls a wellhead or its surroundings such as a gas field or an oil field, a plant that manages and controls power generation such as hydroelectric power, thermal power, and nuclear power, a plant that manages and controls environmental power generation such as solar power and wind power, and a plant that manages and controls water supply and sewage, dams, etc.

The sensor 20 is provided in the industrial process 40 and measures physical quantities in the industrial process 40. The sensor 20 transmits the physical quantity to be measured as a measurement signal to the input device 11 of the control system 1 via a network. In this specification, the sensor 20 includes, for example, sensor devices such as pressure gauges, flow meters, and temperature sensors, microphones that collect abnormal sounds and the like within the plant, position detection devices that output position information of each device, and imaging devices such as cameras and videos that capture images of conditions and objects within the plant.

When the driving device 30 receives an input of a control signal from the output device 12, it drives the industrial process 40 in response to the control signal. The driving device 30 also includes valve devices such as a flow control valve and an on-off valve, and audio devices such as a speaker that emits operation sounds of a fan, a motor, etc., and alarm sounds.

As shown in FIG. 1, the control system 1 includes a control device 10, an input device 11, and an output device 12. The control device 10 is connected to the input device 11 and the output device 12 via a network.

The input device 11 receives a measurement signal from the sensor 20. The input device 11 then transmits the received signal to the control device 10.

The output device 12 receives the control signal transmitted from the control device 10. The output device 12 then outputs the received control signal to the drive device 30. The drive device 30 operates the industrial process 40 in response to the control signal. Here, the input device 11 and the output device 12 may be integrated as hardware.

[Configuration of the control device]
The control device 10 performs a predetermined calculation process based on the measurement signal input from the input device 11, and outputs a control signal according to the calculation result to the output device 12 via a network. The control device 10 is, for example, configured with a computer device. The control device 10 may be included in a distributed control system (DCS). The control device 10 performs a calculation process on the measurement signal input from the input device 11 using a predetermined algorithm to generate a control signal. The function of the control device 10 is configured with hardware 110 such as a CPU and memory, and software including an OS 120, VMs 131 to 133, controllers 141 to 143, and APPs 151 to 153. In the following description, when the VMs 131 to 133 are not distinguished from each other, they are collectively referred to as "VM 130". Furthermore, when the controllers 141 to 143 are not distinguished from each other, they are collectively referred to as "controller 140". Furthermore, when the APPs 151 to 153 are not distinguished from each other, they are collectively referred to as "APP 150".

The control device 10 avoids the occurrence of unstable operation by performing a reconfiguration process for the controller 140 at a stage before the effects of the software error appear, rather than dealing with the unstable operation of the controller 140 after it has occurred due to a software error such as a memory leak. In this way, it is easier to eliminate the overall adverse effects of software errors by systematically reconfiguring the controller 140 rather than suppressing the effects of a controller 140 that is operating unstably.

When reconstructing the controllers 140, the control device 10 controls the operation of at least the number of controllers 140 necessary to ensure the reliability of the control system 1 during reconstruction, in order to maintain and continue the selection of the correct output value in the selection processing unit 160. In addition, the control device 10 ensures the reliability of the control system 1 by performing reconstruction such as restarting or reinstalling the controllers 140 using a simple mechanism described below. The details of the control device 10 are described below.

The control device 10 runs the OS 120 on the hardware 110. For example, when the VM 130 is a guest OS, the OS 120 runs as a host OS. When the OS 120 receives an instruction from the application management unit 170 to start a new VM 130 and controller 140, it starts the new VM 130 and controller 140.

The control device 10 runs multiple virtual machines VM131-133 on the OS 120. VM130 is a guest OS or a container. Each of the VMs 131-133 runs a controller 141-143 and an APP 151-153.

In addition, each VM 130 predicts that a software error will soon occur that will affect the operation of the controller 140. In other words, the multiple VMs 130, which are virtual machines, each operate a controller 140, which is an individual application that executes a specific calculation, and predict the occurrence of a fault in the controller 140 that they operate.

For example, VM 130 detects an increase in its own memory usage and predicts that a memory leak will soon affect the operation of controller 140. Other examples of software errors include unstable operation due to the application of a security patch to OS 120. VM 130 may also predict that a soft error, such as a bit error caused by cosmic rays, will soon affect the operation of controller 140. In the following explanation, a software error is used as an example, but VM 130 can also operate in the same way for soft errors. Hereinafter, the prediction that a software error will soon affect the operation of controller 140 will be referred to as a "software error prediction."

Here, there are no particular limitations on the method by which VM130 predicts a software error. For example, VM130 predicts a software error when the temperature of the CPU (Central Processing Unit) exceeds a threshold for a certain period of time or longer. VM130 may also predict a software error using the operating time of the control device 10, the operating time or number of operation steps of an application including the controller 140, etc. Furthermore, VM130 may predict a software error using any one of the methods, or may predict a software error using a combination of multiple methods.

When a software error is predicted, the VM 130 designates the controller 140 operated by the VM 130 as the target for reconfiguration and notifies the application management unit 170 of a request to reconfigure the controller 140. After that, when the VM 130 receives an instruction to reconfigure from the application management unit 170, it executes the reconfiguration of the controller 140.

Here, the reconstruction of the controller 140 may be any method as long as it can restore the arithmetic processing function of the controller 140 again after the arithmetic processing function of the controller 140 is stopped. In other words, the reconstruction of the controller 140 includes restarting the VM 130 that operates the controller 140, starting the VM 130 after stopping it, and reinstalling the VM 130. Starting the VM 130 after stopping it is different from simply restarting it, and refers to a process of starting the VM 130 after shutting it down. In this case, the information in the memory is completely cleared. Also, in the case of reinstalling the VM 130, the VM 130 and the controller 140 are restarted from the initial state. Here, the controller 140 is an example of an "application". In other words, "reconstruction of an application" is an operation of restoring the arithmetic processing function of an application again after stopping the arithmetic processing function of the application, such as restarting, starting after stopping, and reinstalling. Restarting the controller 140 by restarting the VM 130 and starting the controller 140 after stopping it by starting the VM 130 are each an example of "stopping and starting".

The control device 10 also operates the controller 140 and the APP 150 in each of the VMs 130. The APP 150 is an application other than the controller 140. The control device 10 according to this embodiment has three or more pairs of the VMs 130 and the controllers 140. The APP 150 may control the timing at which the controller 140 outputs a value calculated by calculation.

The controller 140 receives the measurement signal input from the sensor 20 via the input device 11. Next, the controller 140 calculates a value to be applied to the drive device 30 based on the measurement signal input from the sensor 20. In other words, the controller 140 is an application that executes a predetermined calculation to calculate a control value for the industrial process 40. Each controller 140, for example, performs calculation processing on the input measurement signal using a predetermined algorithm and outputs the calculation result. Each controller 140 executes the same control calculation. The same control calculation is a calculation that calculates exactly the same calculation result when the input value is the same and the calculation is performed correctly.

The control device 10 further includes a selection processing unit 160 that operates on the hardware 110. In this embodiment, the selection processing unit 160 is described as operating on the hardware 110, but the selection processing unit 160 may also operate on the OS 120. In this embodiment, the selection processing unit 160 is configured by software. In this case, the selection processing unit 160 may be constructed, for example, by dedicated firmware on the hardware 110.

The selection processing unit 160 manages the operation of each controller 140. Then, upon receiving a request from the application management unit 170, the selection processing unit 160 notifies the application management unit 170 of the total number of controllers 140 that execute the same control calculation.

The selection processing unit 160 also receives inputs of the respective calculation values calculated by each controller 140 from the controller 140. Here, in FIG. 1, for convenience of illustration, a communication path extending from the controller 143 to the selection processing unit 160 is shown, but communication paths also extend from the other controllers 140 to the selection processing unit 160 in a similar manner.

The selection processing unit 160 selects an output value based on the calculation values calculated by each controller 140. Specifically, the selection processing unit 160 selects one calculation value from the calculation values output from each controller 140 as an output value. The selection processing unit 160 then outputs a control signal based on the selected output value to the output device 12. This control signal is sent to the drive device 30, and the industrial process 40 is operated by the drive device 30 in accordance with the control signal. In this way, the selection processing unit 160 selects and outputs the calculation result to be output based on the respective calculation results of the multiple controllers 140 that perform a predetermined calculation to calculate a control value for the industrial process 40.

For example, the sensor 20 is a sensor that measures the flow rate, and the drive unit 30 is an actuator that is attached to a pipe and adjusts the opening of a valve that controls the flow rate of the fluid flowing through the pipe. In this case, a signal of information related to the flow rate measured by the sensor 20 is input to the control unit 10. The selection processing unit 160 acquires, as a calculation value, the result of calculating a value to be output to the actuator based on the information related to the flow rate acquired by each of the multiple controllers 140. Next, the selection processing unit 160 selects one of the acquired calculation values as an output value. The selection processing unit 160 then outputs a control signal based on the selected output value to the output unit 12. When the drive unit 30 then receives the control signal, the flow rate of the fluid flowing through the pipe is adjusted based on the output value.

The selection process of the calculation value by the selection processing unit 160 will be described in more detail. The selection processing unit 160 selects the calculation value to be the output value from among the calculation values output from the multiple controllers 140 by majority logic. That is, the selection processing unit 160 selects the calculation value that is the most common among the calculation values output from the multiple controllers 140 as the output value. Alternatively, the selection processing unit 160 may select the calculation value that is the most common among the calculation values output from the multiple controllers 140 as the output value. Here, the same value may be considered to be the same even if the values do not match completely, as long as they are within a predetermined tolerance range. It is preferable that an appropriate value is set according to the operation, such as within ±1%, for example, as the tolerance range. Furthermore, when there are multiple calculation values within the tolerance range, the selection processing unit 160 may, for example, calculate the average value of the multiple calculation values and output it as the output value. In addition, when there are three or more calculation values within the tolerance range, the selection processing unit 160 may calculate the median and output it as the output value. In this way, if a value that represents multiple calculated values within the allowable range can be calculated and used as the output value, the selection processing unit 160 may determine the output value using another method.

For example, if there are three controllers 140, the selection processing unit 160 acquires the calculation values output from each of the three controllers 140. Here, a case will be described in which any two controllers 140 output the same calculation value and the remaining controller 140 outputs a different calculation value. In this case, the selection processing unit 160 selects the calculation value output by the two controllers 140 as the output value, since this is the calculation value that was output most frequently.

The selection processing unit 160 selects one output value from the calculation values input from each controller 140 using majority logic, and can output a calculation value that can be considered normal even if an abnormality occurs in part of the VM 130 or part of the controller 140. Therefore, the control device 10 can continue to output an output value that can be considered normal, and can drive the drive device 30 normally. However, in order to ensure the reliability that the selection processing unit 160 obtains a calculation value that can be considered normal, it is preferable that more than the minimum number of controllers 140 that can ensure reliability by majority logic are in operation.

The selection processing unit 160 also manages the total number of controllers 140 and the number of controllers 140 that execute the same control calculation. When the selection processing unit 160 receives output from a new controller 140, it increases the number of controllers 140 that execute the same control calculation by one. Conversely, when an abnormality in a controller 140 is detected by value comparison or the like, the selection processing unit 160 decreases the number of controllers 140 that execute the same control calculation by one.

The control device 10 further includes an application management unit 170 that operates on the hardware 110. Here, in FIG. 1, the selection processing unit 160 and the application management unit 170 are illustrated separately, but the application management unit 170 may be included in the selection processing unit 160 as part of the function of the selection processing unit 160.

The application management unit 170 manages the operating states of applications including the VM 130 and the controller 140, such as when they are running or stopped. Furthermore, the application management unit 170 issues instructions for operations such as starting, stopping, and restarting the VM 130. Furthermore, when reconstructing the controller 140, the application management unit 170 determines whether reconstruction is possible, and if reconstruction is possible, causes the controller 140 to be reconstructed.

Specifically, when the application management unit 170 receives a notification from a VM 130 that a software error is predicted, the application management unit 170 determines whether or not to reconstruct the controller 140 operated by the VM 130 that sent the notification, targeting the VM 130 that sent the notification. Furthermore, when the state of the VM 130 or the controller 140 reaches a predetermined condition, the application management unit 170 determines whether or not to reconstruct the controller 140 operated by the VM 130 that has reached the predetermined condition or the controller 140 that has reached the predetermined condition as the target for reconstruction. The predetermined condition is reached, for example, when the operating time of the VM 130 exceeds a predetermined time.

Here, the application management unit 170 can change the criteria for identifying the target to be restarted based on the predetermined conditions depending on the system environment. For example, the application management unit 170 changes the operating time, which is the criterion for determining whether a specific controller 140 is to be rebuilt, depending on the memory size allocated to each VM 130. That is, the application management unit 170 multiplies the installed memory size by a coefficient to calculate the operating time, which is the criterion for the predetermined conditions. For example, when the memory size allocated to the VM 130 is 4 GB, the application management unit 170 calculates the operating time, which is the criterion for the predetermined conditions, as 4 x 1 day = 4 days. Also, when the memory size allocated to the VM 130 is 8 GB, the application management unit 170 calculates the operating time, which is the criterion for the predetermined conditions, as 8 x 1 day = 8 days.

In either case, when a reconfiguration request is received from the VM 130 or when the application management unit 170 itself determines which controller 140 to restart, the application management unit 170 executes the following process for determining whether or not reconfiguration is possible. The details of the process performed by the application management unit 170 for determining whether or not reconfiguration is possible are described below.

The application management unit 170 obtains the total number of controllers 140 that execute the same control operation from the selection processing unit 160. Next, the application management unit 170 subtracts the number of controllers 140 to be reconstructed from the total number of controllers 140 that execute the same control operation to calculate the number of controllers 140 that execute the same control operation during reconstruction. Hereinafter, the controllers 140 that execute the same control operation during reconstruction will be referred to as "controllers 140 that operate during reconstruction". Then, the application management unit 170 judges whether the reliability of the control system 1 can be ensured by the controllers 140 that operate during reconstruction. Ensuring the reliability of the control system 1 means ensuring the reliability of the selection processing unit 160 to select a calculation value that is considered to be correct by majority logic. In other words, if the reliability of the control system 1 can be ensured, the control device 10 can drive the drive device 30 normally.

For example, if the number of controllers 140 operating during reconstruction is more than half of the original total number of controllers 140 executing the same control operation, the application management unit 170 determines that the reliability of the control system 1 can be ensured. Here, an example will be described in which the total number of controllers 140 executing the same control operation is five. If there is one controller 140 to be reconstructed, the application management unit 170 determines that the reliability of the control system 1 can be ensured because the number of controllers 140 operating during reconstruction is four, which is more than half of the original total number. On the other hand, if there are three controllers 140 to be reconstructed, the application management unit 170 determines that it is difficult to ensure the reliability of the control system 1 because the number of controllers 140 operating during reconstruction is two, which is less than half of the original total number.

When it is determined that the reliability of the control system 1 can be ensured, the application management unit 170 determines that the reconstructing of the controller 140 to be reconstructed can be performed. Then, the application management unit 170 instructs the target VM 130 on which the controller 140 to be reconstructed operates to reconstruct the controller 140 operated by that VM 130. That is, the application management unit 170 determines whether the reliability of the output value by the selection processing unit 160 can be ensured by the calculation of the controller 140 other than the controller 140 to be reconstructed, with one or several of the controllers 140 as the reconstructing target, and performs the reconstructing of the controller 140 to be reconstructed if the reliability can be ensured. In addition, the application management unit 170 determines whether to reconstruct each controller 140 based on the operating state of the VM 130 and the controller 140, determines whether the reliability can be ensured by the calculation of the controller 140 other than the controller 140 to be reconstructed, and performs the reconstructing of the controller 140 to be reconstructed if the reliability can be ensured.

In contrast, if it is determined that the overall reliability of the control system 1 cannot be ensured, the application management unit 170 postpones the execution of reconstruction for a certain re-evaluation time. The re-evaluation time can be, for example, one minute. After the re-evaluation time has elapsed, the application management unit 170 re-executes the process of determining whether reconstruction is possible.

When repeating the process of determining whether reconstruction is possible, the application management unit 170 determines whether a certain upper limit time has been reached. The upper limit time can be, for example, five minutes. If reconstruction cannot be performed even after the upper limit time has elapsed, the application management unit 170 instructs the OS 120 to start up a new VM 130 and controller 140. Then, after the new controller 140 is added, the application management unit 170 obtains from the selection processing unit 160 the total number of controllers 140 that execute the same control operation, including the new controller 140. The application management unit 170 then uses the obtained new total number to perform the process of determining whether reconstruction is possible again.

Here, the logic used by the application management unit 170 to determine whether or not to reconstruct can be varied depending on the reliability required for the same control calculation executed by the target controller 140. For example, the application management unit 170 can vary the logic to determine whether or not to restart as follows. That is, when high reliability is required for the same control calculation executed by the controllers 140, the application management unit 170 determines that the reliability of the entire control system 1 can be ensured and a restart should be executed if more than half of the controllers are operating (e.g., three out of five controllers are operating). On the other hand, when high reliability is not required for the same control calculation executed by the controllers 140, the application management unit 170 determines that the reliability of the entire control system 1 can be ensured and a restart should be executed if multiple controllers are operating (e.g., two out of five controllers are operating).

The application management unit 170 may also determine whether or not to restart by adding a minimum number condition, such as three or more, to the number of controllers 140 operating during reconstruction. However, the selection processing unit 160 is more likely to ultimately select the correct output if the number of controllers 140 operating during reconstruction is three rather than two, and four rather than three. Therefore, it is preferable that the minimum number of controllers 140 operating during reconstruction be set according to the operational status.

[Reconstruction process]
2 is a flowchart of a reconstruction process based on a reconstruction request from a VM. Next, a flow of a reconstruction process based on a reconstruction request from the VM 130 in the control device 10 according to the first embodiment will be described with reference to FIG.

The application management unit 170 receives a reconstruction request from the VM 130 (step S101).

Next, the application management unit 170 obtains the total number of controllers 140 that execute the same control calculation from the selection processing unit 160 (step S102).

Next, the application management unit 170 determines whether the reliability of the control system 1 can be ensured even if the controller 140 to be reconstructed, which is the sender of the reconstruction request, is stopped (step S103).

If the reliability of the control system 1 can be ensured even if the controller 140 to be rebuilt is stopped (step S103: Yes), the application management unit 170 instructs the VM 130 that operates the controller 140 to be rebuilt to perform a rebuilt operation (step S104). Then, the application management unit 170 ends the rebuilt process.

In contrast, if stopping the controller 140 to be rebuilt would make it difficult to ensure the reliability of the control system 1 (step S103: No), the application management unit 170 waits for a re-evaluation time, which is a predetermined fixed period of time (step S105).

Next, the application management unit 170 determines whether or not the upper limit time, which is a predetermined fixed time longer than the restart judgment time, has elapsed (step S106). If the upper limit time has not elapsed (step S106: No), the application management unit 170 returns to step S102.

On the other hand, if the upper limit time has elapsed (step S106: Yes), the application management unit 170 instructs the OS 120 to start up a new VM 130 and controller 140 (step S107). After that, the application management unit 170 returns to step S102.

Figure 3 is a flowchart of the reconstruction process based on the decision to reconstruct by the application management unit. Next, the flow of the reconstruction process based on the decision to reconstruct by the application management unit 170 in the control device 10 according to embodiment 1 will be described with reference to Figure 3.

The application management unit 170 determines the controller 140 to be rebuilt based on the operating time of the VM 130 and the controller 140, etc. (step S201).

Next, the application management unit 170 obtains the total number of controllers 140 that execute the same control calculation from the selection processing unit 160 (step S202).

Next, the application management unit 170 determines whether the reliability of the control system 1 can be ensured even if the controller 140 to be rebuilt is stopped (step S203).

If the reliability of the control system 1 can be ensured even if the controller 140 to be rebuilt is stopped (step S203: Yes), the application management unit 170 instructs the VM 130 that operates the controller 140 to be rebuilt to perform the rebuilt operation (step S204). Then, the application management unit 170 ends the rebuilt process.

In contrast, if stopping the controller 140 to be rebuilt would make it difficult to ensure the reliability of the control system 1 (step S203: No), the application management unit 170 waits for a re-evaluation time, which is a predetermined fixed period of time (step S205).

Next, the application management unit 170 determines whether or not the upper limit time, which is a predetermined fixed time longer than the restart judgment time, has elapsed (step S206). If the upper limit time has not elapsed (step S206: No), the application management unit 170 returns to step S202.

On the other hand, if the upper limit time has elapsed (step S206: Yes), the application management unit 170 instructs the OS 120 to start up a new VM 130 and controller 140 (step S207). After that, the application management unit 170 returns to step S202.

In this embodiment, the application management unit 170 determines which VM 130 is to be restarted when the state of the VM 130 or the controller 140 reaches a predetermined condition, but the process of determining which VM 130 is to be restarted may be performed by each VM 130. In this case, the VM 130 notifies the application management unit 170 of an instruction to restart the VM 130 or the controller 140 determined to be the restart target when the state of the VM 130 or the controller 140 reaches a predetermined condition, just as in the case of predicting a software error.

For example, VM 130 determines whether the uptime of the controller 140 it operates has exceeded the uptime threshold corresponding to the memory size allocated to VM 130. If the uptime of the controller 140 it operates has exceeded the uptime threshold, VM 130 predicts the occurrence of a software error. VM 130 then notifies application management unit 170 of a reconstruction request. In this case, application management unit 170 determines the controller 140 to be reconstructed based on the notification from VM 130, and executes a process to determine whether reconstruction is possible.

[effect]
As described above, the control system 1 according to the present embodiment predicts that a software error will affect the operation of the system, and sets the controller 140 for which the software error has been predicted as a target for reconstructing. Furthermore, when the state of the VM 130 or the controller 140 reaches a predetermined condition, the control system 1 sets the VM 130 or the controller 140 as a target for reconstructing. Then, the control system 1 determines whether or not the reliability of the system can be ensured even if the controller 140 targeted for reconstructing stops, and if the reliability can be ensured, reconstructs the VM 130 targeted for reconstructing.

This allows the control system 1 to reconstruct the controller 140 in advance before a software error such as a memory leak actually occurs, making it possible to reduce a decrease in reliability, such as an interruption of control operation due to a software error. Furthermore, since the control system 1 can ensure reliability, such as the continuation of control operation, even while the controller 140 is being reconstructed, it is possible to maintain reliability throughout the entire operation of the system, including normal operation and reconstruction processing. Therefore, it is possible to avoid unstable application operation and improve the reliability of the control system 1.

(Modification)
In the above-mentioned first embodiment, the configuration has been described in which the entire system runs on one piece of hardware 110, but the system configuration is not limited to this.

For example, multiple OSs 120 may run on the hardware 110, and one or more VMs 130 may run on each OS 120. Also, there may be multiple pieces of hardware 110, each of which may run one or more VMs 130. In this case, the selection processing unit 160 and application management unit 170 of any one of the hardware 110 may oversee the selection processing of computation values and the reconstruction of VMs 130 across multiple pieces of hardware 110.

Furthermore, one or more controllers 140 may be physically independent from the hardware 110. Also, a controller 140 that operates on the hardware 110 and a physically independent controller 140 may coexist. Also, the application management unit 170 and the selection processing unit 160 may operate on hardware 110 that is different from the VM 130 and the controller 140.

FIG. 4 is a diagram showing an example of the configuration of a control system according to a modified example of the first embodiment. In FIG. 4, the control system 1 has two control devices 10. Furthermore, the control system 1 has two physical controllers 400 in which controllers 402 operate on controller-dedicated hardware 401. The controllers 402 can perform the same control calculations as the controller 140. In addition to the physical controllers 400, the controllers 402 may be placed on a server on the cloud or a network.

In this case, the selection processing unit 160 and application management unit 170 of one of the two control devices 10 may select the calculation values of all VMs 130 and controllers 140 and 402, and reconstruct the VMs 130. Alternatively, if the controllers 140 and 402 are divided into multiple groups that perform different identical control calculations, a selection processing unit 160 and application management unit 170 in charge of each group may be assigned.

Here, if the VM 130 that runs the controller 140 to be rebuilt runs on an OS 120 different from that of the other VMs 130, rebuilding the controller 140 may include rebooting the OS 120, stopping and then starting the OS 120, and reinstalling the OS 120.

[Embodiment 2]
Next, a second embodiment will be described. A control device 10 according to this embodiment is also shown in the block diagram of FIG. 1. The control device 10 according to this embodiment identifies a controller 140 that is operating peculiarly and issues a reconfiguration request. In the following description, the operation of each unit similar to that of the first embodiment will be omitted.

The selection processing unit 160 receives the calculation values from each controller 140. The selection processing unit 160 then identifies the controller 140 with peculiar behavior from the received calculation values. The selection processing unit 160 then outputs a reconstruction request for the identified controller 140 with peculiar behavior to the application management unit 170.

For example, when the calculation results of a specific controller 140 differ among multiple controllers 140 that perform the same control calculation, the selection processing unit 160 identifies the specific controller 140 as a controller 140 with a unique operation. The selection processing unit 160 may determine that the calculation results of the specific controller 140 differ when the calculation results differ once, or may determine that the calculation results of the specific controller 140 differ when the calculation results differ multiple times. Furthermore, the selection processing unit 160 may determine that the calculation results of the specific controller 140 differ when the calculation results differ a predetermined number of times in succession, or may determine that the calculation results of the specific controller 140 differ when the cumulative number of times they differ reaches a predetermined number.

In addition, for example, in a case where the design is such that calculation results are received within a certain time range, if the reception of the calculation results from a specific controller 140 is delayed for more than a certain time, the selection processing unit 160 identifies the specific controller 140 as a controller 140 with a peculiar operation. This is because it is assumed that the processing power of the controller 140 is reduced due to, for example, a memory leak, and so the selection processing unit 160 identifies a specific controller 140 with a delay of more than a certain time as a controller 140 with a peculiar operation. Here, since the timing at which calculation results arrive at the selection processing unit 160 from multiple applications may differ, the selection processing unit 160 may have a function of waiting for the arrival of the calculation results for a certain period of time.

Furthermore, the selection processing unit 160 may identify a controller 140 that outputs an unselected calculation value among the calculation values of the same control calculation as a controller 140 with a peculiar operation.

In this way, the selection processing unit 160 detects abnormal operation of the controller 140 based on the results of the calculations received from each of the controllers 140, which are applications.

VM 130 may also identify a controller 140 that is behaving peculiarly. For example, VM 130 may detect a fault that can be recovered from by restarting VM 130, such as an abnormality in CPU load or network, as a result of monitoring the general operating state, and determine that the behavior of the controller 140 that it is operating is peculiar. VM 130 then makes a reconfiguration request to application management unit 170.

The application management unit 170 receives a request to reconstruct the controller 140 with peculiar behavior from the selection processing unit 160. Then, the application management unit 170 performs a process of determining whether or not reconstruction is possible, with the controller 140 designated as the controller 140 with peculiar behavior as the reconstructing target. If reconstruction is possible, the application management unit 170 instructs the VM 130 that operates the designated controller 140 with peculiar behavior to reconstruct.

The application management unit 170 may also receive a reconstruction request from a VM 130 that has determined that the operation of the controller 140 operated by the application management unit 170 is peculiar. The application management unit 170 then targets the controller 140 operated by the VM 130 that sent the reconstruction request as the reconstruction target. The application management unit 170 then performs a process to determine whether reconstruction is possible, and if reconstruction is possible, instructs the VM 130 operating the controller 140 with peculiar operation to perform reconstruction.

In this way, the application management unit 170 sets the controller 140 whose operation is peculiar, detected by the selection processing unit 160, as the target for reconstruction, determines whether reliability can be ensured by calculations of controllers 140 other than the target for reconstruction, and performs reconstruction of the controller 140 to be reconstructed if reliability can be ensured.

As described above, the control system 1 according to this embodiment identifies a controller 140 that is behaving peculiarly, and reconstructs a VM 130 that operates the identified controller 140. This makes it possible to reconstruct a controller 140 that is performing unstable operations that may affect the operation of the control system 1, in addition to software errors, before a failure actually occurs, thereby improving the reliability of the control system 1.

[system]
The information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified.

In addition, each component of each device shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure. In other words, all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc.

Furthermore, each processing function performed by each device may be realized, in whole or in part, by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware using wired logic.

[Hardware]
Next, a hardware configuration example of the control device 10 will be described. Fig. 5 is a hardware configuration diagram of the control device. As shown in Fig. 5, the control device 10 has a processor 91, a memory 92, a communication device 93, and a HDD (Hard Disk Drive) 94. The processor 91, the memory 92, the communication device 93, and the HDD 94 are examples of the hardware 110 illustrated in Fig. 1. The processor 91 is connected to the memory 92, the communication device 93, and the HDD 94 via a bus.

The communication device 93 is a network interface card or the like, and is used for communication with other information processing devices. For example, if there are multiple control devices 10, the communication device 93 relays communication between the processors 91 of the different control devices 10.

The HDD 94 is an auxiliary storage device. The HDD 94 stores various programs including programs that realize the functions of the OS 120, VMs 131-133, controllers 141-143, APPs 151-153, selection processing unit 160, and application management unit 170 illustrated in FIG. 1.

The processor 91 reads various programs stored in the HDD 94, expands them into the memory 92, and executes them. In this way, the processor 91 realizes the functions of the OS 120, VMs 131 to 133, controllers 141 to 143, APPs 151 to 153, selection processing unit 160, and application management unit 170, all of which are illustrated in FIG. 1.

In this way, the control device 10 operates as an information processing device that executes various processing methods by reading and executing programs. The control device 10 can also realize functions similar to those of the above-mentioned embodiments by reading the above programs from a recording medium using a media reading device and executing the read programs. Note that the programs referred to here are not limited to those executed by the control device 10. For example, the present invention can be similarly applied to cases where other computers or servers execute programs, or where these execute programs in cooperation with each other.

This program can be distributed via a network such as the Internet. In addition, this program can be recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, an MO (Magneto-Optical disk), or a DVD (Digital Versatile Disc), and can be executed by being read from the recording medium by a computer.

Some examples of combinations of the disclosed technical features are set out below.
(1)
a selection processing unit that selects and outputs a calculation result to be output based on each calculation result of a plurality of applications that execute a predetermined calculation;
a control device comprising: an application management unit that determines whether the reliability of the output by the selection processing unit can be ensured by calculation of an application other than the application to be reconstructed, with one or more of the applications as the target for reconstruction, and performs reconstruction of the application to be reconstructed if the reliability can be ensured.
(2)
the applications execute identical control operations each performing the same operation as the predetermined operation;
The control device according to (1), wherein the selection processing unit selects the calculation result to be output by using majority logic on the calculation results.
(3)
The control device described in (2) is characterized in that the application management unit determines that the reliability can be ensured when the number of applications other than the targets of reconstruction is greater than or equal to the number of applications that can ensure the reliability of the output using the majority logic of the selection processing unit.
(4)
The control device described in any one of (1) to (3), characterized in that the application management unit decides whether or not to reconstruct each application based on the operating state of the application, determines whether the reliability can be ensured by calculation of the application other than the application to be reconstructed, and performs reconstruction of the application to be reconstructed if the reliability can be ensured.
(5)
The selection processing unit detects an abnormal operation of the application based on a result of receiving each of the calculation results of the application;
The control device described in any one of (1) to (4), characterized in that the application management unit, with respect to the application in which abnormal operation has been detected by the selection processing unit as a target for reconstruction, determines whether the reliability can be ensured by calculation of the application other than the target for reconstruction, and performs reconstruction of the application to be reconstructed if the reliability can be ensured.
(6)
The control device according to any one of (1) to (5), characterized in that the application management unit reconstructs the application to be reconstructed by stopping and starting, or reinstalling, the application to be reconstructed.
(7)
The control device according to any one of (1) to (6), characterized in that the application management unit controls the number of applications to be operated so as to ensure the reliability of the output by the selection processing unit during reconstruction.
(8)
The control device described in any one of (1) to (7) is characterized in that when the selection processing unit receives output from a new application, it increases the number of applications that execute the specified calculation by one, and when it detects an abnormality in the application, it decreases the number of applications that execute the specified calculation by one, thereby determining whether the reliability of the output by the selection processing unit can be ensured.
(9)
The control device according to any one of (1) to (8), characterized in that the application management unit differs in its judgment logic for determining whether the reliability of the output by the selection processing unit can be ensured depending on the reliability required for the specified calculation executed by the application.
(10)
The control device according to any one of (1) to (9), characterized in that the application management unit determines the application to be reconstructed based on the operating time of the application.
(11)
The control device according to any one of (1) to (10), wherein the application is an application that executes the predetermined calculation to calculate a control value for an industrial process.
(12)
A control system having an input device for receiving an input of a measurement result from a sensor disposed in a plant facility, an output device for driving a drive device that drives a mechanism disposed in the plant facility, and a control device, the control device comprising:
a plurality of virtual machines each running an application that executes a predetermined calculation based on the measurement results of the sensor input to the input device;
a selection processing unit that selects an operation result to be output based on each operation result of the application, and outputs the selected operation result from the output device to drive the drive device;
a control system comprising: an application management unit that determines whether the reliability of the output by the selection processing unit can be ensured by calculations of applications other than the application to be reconstructed, with one or more of the applications as the target for reconstruction, and performs reconstruction of the application to be reconstructed if the reliability can be ensured.
(13)
The control device includes:
Executing a plurality of applications that perform predetermined operations;
selecting and outputting a calculation result to be output based on the calculation result of each of the plurality of applications; determining whether or not the reliability of the output of the calculation result to be output can be ensured based on the calculation result of the application other than the application to be reconstructed, with one or some of the applications as a reconstruction target;
and executing reconstruction of the application to be reconstructed when the reliability can be ensured.
(14)
Running a plurality of applications that execute predetermined operations;
Selecting and outputting a calculation result based on the calculation results of each of the plurality of applications;
determining whether or not the reliability of the output of the calculation result to be output can be ensured based on the calculation result of the application other than the application to be reconstructed, with one or some of the applications being the object of reconstruction;
and if the reliability can be ensured, reconstructing the application to be reconstructed.

REFERENCE SIGNS LIST 1 Control system 10 Control device 11 Input device 12 Output device 20 Sensor 30 Drive device 110 Hardware 120 OS
130-133 VM (Virtual Machine)
140 to 143 Controller 150 to 153 APP
160 Selection processing unit 170 Application management unit

Claims (14)

a selection processing unit that selects and outputs a calculation result to be output based on each calculation result of a plurality of applications that execute a predetermined calculation;
a control device comprising: an application management unit that, by setting one or more of the applications as targets for reconstruction, determines whether the reliability of the output by the selection processing unit can be ensured by the operations of the applications other than the targets for reconstruction by changing the judgment logic depending on the reliability required for the specified operations performed by the applications, and performs reconstruction of the application to be reconstructed if the reliability can be ensured. a selection processing unit that selects and outputs a calculation result to be output based on each calculation result of a plurality of applications that execute a predetermined calculation;
a control device comprising: an application management unit that determines an application to be reconstructed from among the plurality of applications based on the operating time of the application , determines whether the reliability of the output by the selection processing unit can be ensured by calculation of the application other than the application to be reconstructed, and performs reconstruction of the application to be reconstructed if the reliability can be ensured. The control device according to claim 1, characterized in that the application management unit determines whether or not to reconstruct each of the applications based on the operating state of the applications, determines whether or not the reliability can be ensured by calculation of the applications other than the one to be reconstructed, and performs reconstruction of the application to be reconstructed if the reliability can be ensured. The selection processing unit detects an abnormal operation of the application based on a result of receiving each of the calculation results of the application;
The control device according to claim 1, characterized in that the application management unit, with respect to the application in which abnormal operation has been detected by the selection processing unit as the target for reconstruction, determines whether the reliability can be ensured by calculation of the application other than the target for reconstruction, and performs reconstruction of the application to be reconstructed if the reliability can be ensured. The control device according to claim 1, characterized in that the application management unit reconstructs the application to be reconstructed by stopping and starting the application to be reconstructed, or by reinstalling the application. The control device according to claim 1, characterized in that the application management unit controls the number of applications to be operated so that the number of applications that can ensure the reliability of the output by the selection processing unit during reconstruction is equal to or greater than the number of applications that can be operated. The control device according to claim 1, characterized in that the selection processing unit, when receiving an output from a new application, increases the number of applications that execute the specified calculation by one, and when detecting an abnormality in the application, decreases the number of applications that execute the specified calculation by one, and determines whether the reliability of the output by the selection processing unit can be ensured. The control device according to claim 1, characterized in that the application is an application that executes the predetermined calculation to calculate a control value for an industrial process. A control system having an input device for receiving an input of a measurement result from a sensor disposed in a plant facility, an output device for driving a drive device that drives a mechanism disposed in the plant facility, and a control device, the control device comprising:
a plurality of virtual machines each running an application that executes a predetermined calculation based on the measurement results of the sensor input to the input device;
a selection processing unit that selects an operation result to be output based on each operation result of the application, and outputs the selected operation result from the output device to drive the drive device;
and an application management unit that, when one or more of the applications are to be reconstructed, determines whether the reliability of the output by the selection processing unit can be ensured by the operations of the applications other than the applications to be reconstructed by changing the judgment logic depending on the reliability required for the specified operations performed by the applications, and performs reconstruction of the application to be reconstructed if the reliability can be ensured. A control system having an input device for receiving an input of a measurement result from a sensor disposed in a plant facility, an output device for driving a drive device that drives a mechanism disposed in the plant facility, and a control device, the control device comprising:
a plurality of virtual machines each running an application that executes a predetermined calculation based on the measurement results of the sensor input to the input device;
a selection processing unit that selects an operation result to be output based on each operation result of the application, and outputs the selected operation result from the output device to drive the drive device;
and an application management unit that determines which applications are to be rebuilt from among the applications based on the operating time of the applications , determines whether the reliability of the output by the selection processing unit can be ensured through calculations of the applications other than the applications to be rebuilt, and performs reconstruction of the applications to be rebuilt if the reliability can be ensured. The control device includes:
Executing a plurality of applications that perform predetermined operations;
Selecting and outputting a calculation result based on the calculation results of each of the plurality of applications
One or some of the applications are set as reconstructing targets, and whether or not the reliability of the output of the computation result to be output can be ensured based on the computation result of the application other than the reconstructing target is determined by varying a determination logic according to the reliability required for the predetermined computation executed by the application ;
and executing reconstruction of the application to be reconstructed when the reliability can be ensured. The control device includes:
Executing a plurality of applications that perform predetermined operations;
Selecting and outputting a calculation result based on the calculation results of each of the plurality of applications
determining an application to be reconstructed from among the plurality of applications based on the operation time of the application , and determining whether or not the reliability of the output of the computation result to be output can be ensured based on the computation result of the application other than the application to be reconstructed;
and executing reconstruction of the application to be reconstructed when the reliability can be ensured. Running a plurality of applications that execute predetermined operations;
Selecting and outputting a calculation result based on the calculation results of each of the plurality of applications;
One or some of the applications are set as reconstructing targets, and whether or not the reliability of the output of the computation result to be output can be ensured based on the computation result of the application other than the reconstructing target is determined by varying a determination logic according to the reliability required for the predetermined computation executed by the application ;
and if the reliability can be ensured, reconstructing the application to be reconstructed. Running a plurality of applications that execute predetermined operations;
Selecting and outputting a calculation result based on the calculation results of each of the plurality of applications;
determining an application to be reconstructed from among the plurality of applications based on the operation time of the application , and determining whether or not the reliability of the output of the computation result to be output can be ensured based on the computation result of the application other than the computation result to be reconstructed;
and if the reliability can be ensured, reconstructing the application to be reconstructed.

Images